EUVD-2026-90664
GHSA-2fr8-wvwh-rx7v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote unauthenticated Content API access with no interaction (AV:N/AC:L/PR:N/UI:N); full disclosure of restricted content gives C:H, with no integrity/availability impact and unchanged scope.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
5DescriptionCVE.org
Ghost versions from 4.0.0 before 6.63.0 contain a content API vulnerability that allows unauthenticated visitors to access gated post content. Attackers can bypass content restrictions by directly querying the content API to retrieve restricted posts without authentication.
Articles & Coverage 1
AnalysisAI
Unauthenticated visitors can pull the full body of gated, members-only and paid-tier posts from Ghost 4.0.0 through 6.62.x by querying the platform's Content API directly, bypassing the membership restrictions that are supposed to withhold that content. The flaw is an authorization-checking failure (CWE-863) in post visibility filtering, scored 8.7 under CVSS 4.0 and assessed as CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - fully remote and unauthenticated, with high confidentiality impact and no integrity or availability effect. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitable only against Ghost instances (4.0.0 to before 6.63.0) that actually host gated/restricted post content - i.e., sites configured with members-only or paid-tier access controls; a site with no gated posts has nothing to disclose. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 base score of 8.7 (High) is driven by a fully remote, unauthenticated, low-complexity vector (AV:N/AC:L/AT:N/PR:N/UI:N) with high confidentiality impact (VC:H) and no integrity or availability impact (VI:N/VA:N) - consistent with a read-only disclosure of gated content. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Ghost to 6.63.0 or later, which is the first release outside the affected range and the version referenced by the vendor advisory GHSA-rcx7-6m7p-xw5c; patch availability is confirmed by the vendor, and the same two advisories (https://github.com/TryGhost/Ghost/security/advisories/GHSA-rcx7-6m7p-xw5c and https://www.vulncheck.com/advisories/ghost-4.0.0-before-6.63.0-restricted-content-bypass) should be checked for any backport or exact hotfix build for the 4.x/5.x lines, since released patched versions for those branches were not independently confirmed from the supplied data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every Ghost instance in the estate and confirm which are running versions 4.0.0 through 6.62.x with any gated, members-only, or paid-tier content published; treat the premium content on those instances as potentially disclosed and notify content owners and legal/comms stakeholders if the material is contractually or competitively sensitive. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today